Selling company data to AI labs in the United States
Before company data goes to an AI lab, the privacy law where the people in it live asks one question: can anyone still be identified from it? This page explains the main laws in the United States, what counts as no longer personal, and what to check first. General information as of 2026-10-27, not legal advice: your counsel confirms what applies to your company.
At a glance
| Main laws | The United States has no single national privacy law. Rules depend on the kind of data and who holds it. Health data falls under HIPAA, financial data under GLBA, student records under FERPA, children's online data under COPPA, and consumer data under state laws such as California's CCPA. The FTC Act covers misleading privacy claims across the board. |
|---|---|
| What counts as de-identified | It depends on the law. HIPAA gives two fixed methods: remove 18 types of identifiers (Safe Harbor) or have a qualified expert find the risk of identification very small (Expert Determination). Other laws use a general test of whether the data can reasonably be linked to a person. The FTC says hashing a name or email does not make data anonymous. |
| Who enforces | HHS Office for Civil Rights for HIPAA, the FTC for deceptive claims and children's privacy, state attorneys general, and in California the California Privacy Protection Agency. The Department of Education handles FERPA. |
| Moving data abroad | There is no general ban on sending data to another country. A Department of Justice rule limits some transfers of bulk sensitive personal data to listed countries of concern and to people connected to them. Sector laws such as HIPAA still apply to the data after it moves. |
The main laws, and what each means for selling data
HIPAA Privacy Rule, de-identification standard (45 CFR 164.514)
Health plans, health care providers that bill electronically, and clearinghouses, plus the vendors that handle health information for them. It covers health information that identifies a person or could be used to identify one.
A hospital group cannot hand patient notes to an AI lab just because the names look removed. The rule lets a covered entity treat the data as not individually identifiable only through Safe Harbor (remove listed identifiers such as names, small geographic areas, most date elements, phone numbers, email addresses, record numbers and IP addresses, with no actual knowledge the rest could identify someone) or Expert Determination (a qualified expert finds the risk very small and documents it). Free text in clinical notes often holds identifiers, so it needs checking before a transfer.
Source: eCFR, 45 CFR 164.514
California Consumer Privacy Act as amended by the CPRA (Civil Code 1798.100 and following)
For-profit businesses that do business in California and meet a size or data threshold: a revenue threshold set in the statute, a volume of California residents' or households' personal information, or a large share of revenue from selling or sharing personal information. It protects California residents' personal information.
If a retailer gives customer support tickets that still contain names and order numbers to an AI lab for money, that can count as a sale of personal information, which brings notice and opt-out duties. The Act has its own definition of deidentified data, which turns on whether the data can reasonably be linked to a person, whether the business takes steps to prevent re-linking, and whether it commits publicly and by contract not to re-identify. Check the current statute text for the exact conditions.
Source: California Attorney General, CCPA page; statute text at the California Legislature
Other state comprehensive privacy laws
A growing group of states, including Virginia, Colorado, Connecticut and Texas, have passed broad consumer privacy laws. Counts differ by source and change as new laws take effect, so check the current list for the states where your customers live.
These laws usually exempt properly de-identified data and often require the seller to publicly commit not to re-identify it and to bind the recipient by contract. A software company with customers in many states may face several sets of rules at once. Employee and business-to-business data are treated differently from state to state.
Source: State attorney general and legislature sites; check each state's own page
FTC Act, section 5 (unfair or deceptive practices)
Nearly all businesses in commerce. It applies to what a company says about its data practices and to unfair handling of personal information.
If a company tells customers their data is anonymous or will not be shared, then sells it, the claim has to be true. The FTC states that data is anonymous only if it can never be linked back to a person, and that hashing an email address or device ID does not meet that bar.
Gramm-Leach-Bliley Act Privacy Rule (16 CFR Part 313 for FTC-covered firms)
Financial institutions and the nonpublic personal information of their consumers and customers, such as account balances, payment history and the fact that someone is a customer.
A lender that wants to give loan files to an AI lab must look at the notice and opt-out rules for sharing with outside companies. Information that does not identify a consumer, such as aggregate data or blind data without names or account numbers, falls outside the definition. Lists of customers built from account information can still count.
Source: eCFR, 16 CFR 313.3
FERPA (34 CFR Part 99)
Schools and colleges that receive federal education funds, and parties that receive education records from them.
A learning platform holding student records from a school cannot release them without consent unless all personally identifiable information is removed and a reasonable determination is made that a student's identity is not personally identifiable. That judgment must consider single and repeated releases and other information reasonably available. Small classes make this harder.
Source: eCFR, 34 CFR 99.31(b)(1)
COPPA Rule (16 CFR Part 312)
Operators of websites and online services directed to children under 13, or that know they collect data from them. Personal information includes names, online contact details, persistent identifiers such as cookie numbers and device IDs, photos, voice recordings and precise location.
A kids' game studio that releases chat logs or voice clips with persistent identifiers to a third party is making a disclosure of children's personal information. Under the rule, releasing it in identifiable form for any purpose is a disclosure, with narrow exceptions for internal operations support. Data from children needs special care before any transfer.
Source: eCFR, 16 CFR 312.2
How US law decides data is no longer personal
There is no single US test. Each law sets its own. HIPAA is the most exact. Under 45 CFR 164.514, health information is not individually identifiable if it does not identify a person and there is no reasonable basis to believe it can be used to identify one. A covered entity may treat it that way only through one of two methods. Safe Harbor removes a list of identifiers, including names, geographic areas smaller than a state (with a limited ZIP code exception), date elements other than year, phone and fax numbers, email addresses, record and account numbers, device identifiers, web addresses, IP addresses, biometric identifiers and full-face photographs. The entity must also have no actual knowledge that what remains could identify someone. Expert Determination uses a person with suitable statistical and scientific knowledge who finds the risk is very small that a recipient could identify a person, alone or with other reasonably available information, and who documents the methods and results.
Other laws use a general test. FERPA requires removal of all personally identifiable information and a reasonable determination that no student can be identified, considering other releases and reasonably available information. California's CCPA and the state laws modelled on similar ideas look at whether data can reasonably be linked to a person and whether the business commits not to re-identify it. The FTC adds a warning on claims: it says data is anonymous only if it can never be linked to a person, and that hashed identifiers are not anonymous because they still tie records to the same person or device over time.
A re-identification check in practice means testing what remains. Examples are searching free text for names and numbers, looking for rare combinations such as a small town plus a job title plus a date, and asking whether another dataset could be joined to the records. The seller applies the test, not the buyer. Substance abuse treatment records covered by 42 CFR Part 2 point to the HIPAA de-identification standard in 45 CFR 164.514(b).
Sources: eCFR, 45 CFR 164.514, eCFR, 34 CFR 99.31, FTC Office of Technology, hashing and anonymity, eCFR, 42 CFR 2.16
Records that carry extra rules
Health records
HIPAA applies to health information held by covered entities and their vendors, and data may leave only by lawful disclosure or after Safe Harbor or Expert Determination under 45 CFR 164.514.
Substance use disorder treatment records
42 CFR Part 2 adds duties for programs and other lawful holders of these records, including policies that cover de-identifying information under 45 CFR 164.514(b).
Children's data
The COPPA Rule treats persistent identifiers, photos, voice recordings and precise location from children under 13 as personal information, and releasing it in identifiable form is a disclosure.
Student records
FERPA lets schools and their recipients release records without consent only after removing all personally identifiable information and making a reasonable determination that no student can be identified.
Bank and lending data
The GLBA Privacy Rule protects nonpublic personal information from financial institutions. Information that does not identify a consumer, such as aggregate or blind data, is outside the definition.
Sending data to an AI lab in another country
The United States has no general rule that stops a company from sending data to an AI lab in another country. Sector rules still follow the data. A HIPAA covered entity still needs a lawful basis and the right agreements, and the other laws above apply no matter where the buyer sits.
A Department of Justice rule, 28 CFR Part 202, restricts or prohibits some transactions that give countries of concern, and people connected to them, access to bulk US sensitive personal data. The rule sets bulk thresholds that differ by type of data, such as health, financial, biometric and genomic data. The sources do not show whether de-identified data falls outside it, so a seller with a large dataset should check the rule and the DOJ guidance before any transfer.
Sources: eCFR, 28 CFR Part 202, DOJ National Security Division, Data Security Program FAQs
Who enforces it
Questions about selling data from the United States
Is it legal to sell company data to an AI company in the United States?
There is no single law that bans it, and the answer depends on what the data holds. Data with customer, patient, student or child information triggers rules such as HIPAA, state privacy laws, FERPA or COPPA. Company data with no personal information, such as product specifications, faces fewer privacy rules but may still be limited by contracts. This is general information, not legal advice.
What does de-identified mean under HIPAA?
HIPAA allows two methods. Safe Harbor removes a list of identifiers such as names, small geographic areas, date elements other than year, phone numbers, email addresses and record numbers, and requires no actual knowledge that the rest could identify someone. Expert Determination has a qualified expert document that the risk of identification is very small. This is general information, not legal advice.
Does hashing or removing names make data anonymous?
Not by itself, according to the FTC. It says data is anonymous only if it can never be linked back to a person, and that hashed emails, phone numbers or device IDs can still single out a person over time. Free text can also hold names and numbers that a field-level removal misses. This is general information, not legal advice.
Do state privacy laws apply when a company sells its data?
They can. A growing number of states have comprehensive privacy laws, and California's applies to businesses over set revenue or data thresholds. Many give opt-out rights over the sale of personal information and treat properly de-identified data differently. Rules differ by state, so a seller should check each one that applies. This is general information, not legal advice.
Can company data be sent to an AI lab outside the United States?
Often yes, but sector laws such as HIPAA still apply, and a Department of Justice rule limits some transfers of bulk sensitive personal data to listed countries of concern and connected people. The rule's thresholds differ by type of data. A seller should check the rule and the buyer's location first. This is general information, not legal advice.
Didn't find your question? Ask us directly.
What we do about it
We find and remove the personal information in your company data, test whether anyone could still be identified, and write down how it was done for your counsel. If you license the data through us, the AI lab usually pays for that work, and the AI lab pays our broker fee, only after the deal closes. See how de-identification works and how licensing your data works.
Rules in other regions
- Canada: PIPEDA, Quebec Law 25, the provincial acts, and health information laws.
- United Kingdom: The UK GDPR, the Data Protection Act 2018, the 2025 Act and the ICO anonymisation guidance.
- European Union: The GDPR, the EDPB on anonymisation and AI models, and the EU AI Act.
- Australia: The Privacy Act 1988, the Australian Privacy Principles, OAIC guidance and health records laws.